Httpd
Httpd
安装httpd服务
//以下为源码安装
//1.准备工作
[root@localhost ~]# yum -y install wget bzip2 gcc gcc-c++ make pcre-devel expat-devel libxml2-devel
//2.下载源码包
[root@localhost ~]# wget https://mirrors.tuna.tsinghua.edu.cn/apache/httpd/httpd-2.4.46.tar.bz2
[root@localhost ~]# wget https://mirrors.tuna.tsinghua.edu.cn/apache//apr/apr-1.7.0.tar.gz
[root@localhost ~]# wget https://mirrors.tuna.tsinghua.edu.cn/apache//apr/apr-util-1.6.1.tar.gz
[root@localhost ~]# ls
anaconda-ks.cfg apr-1.7.0.tar.gz apr-util-1.6.1.tar.gz httpd-2.4.46.tar.bz2
//3.安装apr
[root@localhost ~]# tar xf apr-1.7.0.tar.gz
[root@localhost ~]# cd apr-1.7.0
[root@localhost apr-1.7.0]# vi configure
//注释这一行
# $RM "$cfgfile"
[root@localhost apr-1.7.0]# ./configure --prefix=/usr/local/apr
[root@localhost apr-1.7.0]# make
[root@localhost apr-1.7.0]# make install
//4.安装apr-util
[root@localhost apr-1.7.0]# cd
[root@localhost ~]# tar xf apr-util-1.6.1.tar.gz
[root@localhost ~]# cd apr-util-1.6.1
[root@localhost apr-util-1.6.1]# ./configure --prefix=/usr/local/apr-util --with-apr=/usr/local/apr
[root@localhost apr-util-1.6.1]# make
[root@localhost apr-util-1.6.1]# make install
//5.安装httpd
[root@localhost apr-util-1.6.1]# cd
[root@localhost ~]# tar xf httpd-2.4.46.tar.bz2
[root@localhost ~]# cd httpd-2.4.46
[root@localhost httpd-2.4.46]# ./configure --prefix=/usr/local/apache \
--sysconfdir=/etc/httpd24 \
--enable-so \
--enable-ssl \
--enable-cgi \
--enable-rewrite \
--with-zlib \
--with-pcre \
--with-apr=/usr/local/apr \
--with-apr-util=/usr/local/apr-util/ \
--enable-modules=most \
--enable-mpms-shared=all \
--with-mpm=prefork
[root@localhost httpd-2.4.46]# make
[root@localhost httpd-2.4.46]# make install
//6.设置环境变量
[root@localhost ~]# vi /etc/profile.d/httpd.sh
export PATH=$PATH:/usr/local/httpd/bin
[root@localhost ~]# source /etc/profile.d/httpd.sh
//7.设置头文件链接
[root@localhost ~]# ln -s /usr/local/httpd/include /usr/include/httpd
//8.设置帮助文档（加入以下内容）
[root@localhost ~]# vi /etc/man_db.conf
MANDATORY_MANPATH /usr/local/httpd/man
MANDATORY_MANPATH /usr/local/httpd/manual
//9.管理httpd
[root@localhost ~]# apachectl start
[root@localhost ~]# apachectl stop
[root@localhost ~]# apachectl restart
//10.关闭防火墙和SELiunx
[root@localhost ~]# systemctl stop firewalld
[root@localhost ~]# setenforce 0
httpd配置
切换使用MPM
（编辑/etc/httpd/conf.modules.d/00-mpm.conf文件）：
[root@localhost ~]# cd /etc/httpd/conf.modules.d/
[root@localhost conf.modules.d]# ls
00-base.conf 00-lua.conf 00-optional.conf 00-systemd.conf 10-h2.conf README
00-dav.conf 00-mpm.conf 00-proxy.conf 01-cgi.conf 10-proxy_h2.conf
[root@localhost conf.modules.d]# vim 00-mpm.conf
# Select the MPM module which should be used by uncommenting exactly
# one of the following LoadModule lines. See the httpd.conf(5) man
# page for more information on changing the MPM.
# prefork MPM: Implements a non-threaded, pre-forking web server
# See: http://httpd.apache.org/docs/2.4/mod/prefork.html
#
# NOTE: If enabling prefork, the httpd_graceful_shutdown SELinux
# boolean should be enabled, to allow graceful stop/shutdown.
#
#LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
# worker MPM: Multi-Processing Module implementing a hybrid
# multi-threaded multi-process web server
# See: http://httpd.apache.org/docs/2.4/mod/worker.html
#
#LoadModule mpm_worker_module modules/mod_mpm_worker.so
# event MPM: A variant of the worker MPM with the goal of consuming
# threads only for connections with active processing
# See: http://httpd.apache.org/docs/2.4/mod/event.html
#
LoadModule mpm_event_module modules/mod_mpm_event.so
切换方式：用哪种模式就在相应的那一行取消注释，注意不能同时用两个模式，只能有一个启用。
访问控制法则
| 法则 | 功能 |
|---|---|
| Require all granted | 允许所有主机访问 |
| Require all deny | 拒绝所有主机访问 |
| Require ip IPADDR | 授权指定来源地址的主机访问 |
| Require not ip IPADDR | 拒绝指定来源地址的主机访问 |
| Require host HOSTNAME | 授权指定来源主机名的主机访问 |
| Require not host HOSTNAME | 拒绝指定来源主机名的主机访问 |
默认首页在/var/www/html/index.html
//在/var/www/html中创建一个test文件夹
[root@localhost html]# mkdir test
[root@localhost html]# echo 'haha' > /var/www/html/test/index.html
访问192.168.21.129/test/：
请问如果想让有些人能访问test，有些人不能访问，应该怎么做呢？
比如192.168.21.1不让访问test：
[root@localhost ~]# vim /etc/httpd/conf/httpd.conf
<Directory "/var/www/html">
#
# Possible values for the Options directive are "None", "All",
# or any combination of:
# Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
#
# Note that "MultiViews" must be named *explicitly* --- "Options All"
# doesn't give it to you.
#
# The Options directive is both complicated and important. Please see
# http://httpd.apache.org/docs/2.4/mod/core.html#options
# for more information.
#
Options Indexes FollowSymLinks
#
# AllowOverride controls what directives may be placed in .htaccess files.
# It can be "All", "None", or any combination of the keywords:
# Options FileInfo AuthConfig Limit
#
AllowOverride None
#
# Controls who can get stuff from this server.
#
Require all granted
</Directory>
//在后面加上这个访问控制法则，192.168.21.1为本机地址
<Directory "/var/www/html/test">
<RequireAll>
Require not ip 192.168.21.1
Require all granted
</RequireAll>
</Directory>
[root@localhost ~]# systemctl restart httpd
[root@localhost html]# curl http://192.168.21.129/test/index.html
haha
如果将法则改为192.168.21.129：
[root@localhost html]# vim /etc/httpd/conf/httpd.conf
<Directory "/var/www/html/test">
<RequireAll>
Require not ip 192.168.21.129
Require all granted
</RequireAll>
</Directory>
或
<Directory "/var/www/html/test">
Require ip 192.168.21.1
</Directory>
[root@localhost html]# systemctl restart httpd
[root@localhost html]# curl http://192.168.21.129/test/index.html
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access /test/index.html
on this server.<br />
</p>
</body></html>
则虚拟机无法访问，本机可以访问
三种虚拟主机的配置
虚拟主机有三类：
-
相同IP不同端口
-
不同IP相同端口
-
相同IP相同端口不同域名
相同IP不同端口
[root@localhost ~]# hostname
localhost.localdomain
[root@localhost ~]# hostnamectl set-hostname www.example.com
[root@localhost ~]# bash
[root@www ~]# hostname
www.example.com
[root@www ~]# cd /etc/httpd/conf.d
[root@www conf.d]# find / -name *vhosts.conf
/usr/share/doc/httpd/httpd-vhosts.conf
[root@www conf.d]# cp /usr/share/doc/httpd/httpd-vhosts.conf .
[root@www conf.d]# ls
autoindex.conf httpd-vhosts.conf README userdir.conf welcome.conf
[root@www conf.d]# vim httpd-vhosts.conf
<VirtualHost *:80>
DocumentRoot "/var/www/html/"
ServerName www.example.com
ErrorLog "/var/log/httpd/www.example.com-error_log"
CustomLog "/var/log/httpd/www.example.com-access_log" common
</VirtualHost>
[root@www conf.d]# systemctl restart httpd
在源码之家上下2个HTML5实例
[root@www ~]# ls
anaconda-ks.cfg HTML5_Windows10.zip taikongheidongdonghua.zip
[root@www ~]# unzip HTML5_Windows10.zip taikongheidongdonghua.zip
[root@www ~]# mv HTML5模仿Windows10桌面代码 win10
[root@www ~]# mv HTML5太空黑洞动画代码 taikong
[root@www ~]# ls
anaconda-ks.cfg HTML5_Windows10.zip taikong taikongheidongdonghua.zip win10
[root@www ~]# mv taikong win10 /var/www/html/
[root@www ~]# cd /var/www/html/
[root@www html]# ls
index.html taikong test win10
[root@www ~]# vim /etc/httpd/conf.d/httpd-vhosts.conf
<VirtualHost *:80>
DocumentRoot "/var/www/html/win10"
ServerName win10.example.com
ErrorLog "/var/log/httpd/win10.example.com-error_log"
CustomLog "/var/log/httpd/win10.example.com-access_log" common
</VirtualHost>
Listen 81
<VirtualHost *:81>
DocumentRoot "/var/www/html/taikong"
ServerName taikong.example.com
ErrorLog "/var/log/httpd/taikong.example.com-error_log"
CustomLog "/var/log/httpd/taikong.example.com-access_log" common
</VirtualHost>
[root@www ~]# systemctl restart httpd
访问192.168.21.129:80
访问192.168.21.129:81
不同IP相同端口
[root@www ~]# vim /etc/httpd/conf.d/httpd-vhosts.conf
<VirtualHost 192.168.21.129:80>
DocumentRoot "/var/www/html/win10"
ServerName win10.example.com
ErrorLog "/var/log/httpd/win10.example.com-error_log"
CustomLog "/var/log/httpd/win10.example.com-access_log" common
</VirtualHost>
<VirtualHost 192.168.21.250:80>
DocumentRoot "/var/www/html/taikong"
ServerName taikong.example.com
ErrorLog "/var/log/httpd/taikong.example.com-error_log"
CustomLog "/var/log/httpd/taikong.example.com-access_log" common
</VirtualHost>
[root@www ~]# systemctl restart httpd
[root@www ~]# ip a
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:c8:3e:c8 brd ff:ff:ff:ff:ff:ff
inet 192.168.21.129/24 brd 192.168.21.255 scope global dynamic noprefixroute ens160
valid_lft 908sec preferred_lft 908sec
inet6 fe80::197b:f289:f6a9:5e1d/64 scope link noprefixroute
valid_lft forever preferred_lft forever
[root@www ~]# ip addr add 192.168.21.250/24 dev ens160
[root@www ~]# ip a
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:c8:3e:c8 brd ff:ff:ff:ff:ff:ff
inet 192.168.21.129/24 brd 192.168.21.255 scope global dynamic noprefixroute ens160
valid_lft 1783sec preferred_lft 1783sec
inet 192.168.21.250/24 scope global secondary ens160
valid_lft forever preferred_lft forever
inet6 fe80::197b:f289:f6a9:5e1d/64 scope link noprefixroute
valid_lft forever preferred_lft forever
访问192.168.21.129
访问192.168.21.250
相同IP相同端口不同域名
[root@www ~]# vim /etc/httpd/conf.d/httpd-vhosts.conf
<VirtualHost *:80>
DocumentRoot "/var/www/html/win10"
ServerName win10.example.com
ErrorLog "/var/log/httpd/win10.example.com-error_log"
CustomLog "/var/log/httpd/win10.example.com-access_log" common
</VirtualHost>
<VirtualHost *:80>
DocumentRoot "/var/www/html/taikong"
ServerName taikong.example.com
ErrorLog "/var/log/httpd/taikong.example.com-error_log"
CustomLog "/var/log/httpd/taikong.example.com-access_log" common
</VirtualHost>
[root@www ~]# systemctl restart httpd
IP地址映射：
hosts目录
C:\Windows\System32\drivers\etc\hosts
192.168.21.129 win10.example.com taikong.example.com
访问win10.example.com
访问taikong.example.com
https配置
CA的配置文件：/etc/pki/tls/openssl.cnf
CA生成一对密钥
[root@www ~]# cd /etc/pki/CA
bash: cd: /etc/pki/CA: No such file or directory
[root@www ~]# mkdir /etc/pki/CA
[root@www ~]# cd /etc/pki/CA
//生成密钥
[root@www CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
genrsa: Can't open "private/cakey.pem" for writing, No such file or directory
[root@www CA]# mkdir private
[root@www CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
.....................................................................................+++++
................................+++++
e is 65537 (0x010001)
[root@www CA]# ls private/
cakey.pem
//提取公钥
[root@www CA]# openssl rsa -in private/cakey.pem -pubout
writing RSA key
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1vk5foqHDeMcPTXJHFeS
ZjICQsb/Af8SJH6351kuG5kL5Axjq1XsUbuM3FZyIwJ7HpV1CQBlfhJJ1ku6EkfU
1wRq+9G+ZE03sONBIpXqUsuTnMw0CDBZWXHFlwzi2iI3PpIVZLNNkk4DiHN3jJVm
ypjclmA0r25SSXdClyP68/63OaeIgg0GZptsulKdTzaxPxDwByE4mGjX4497aFzY
FKEYKDLkUAhK4LJcUoCuLmu3Vj+3hnHl/YvOLKgm9D+I3UO5ATQaIrVEbSWUyoDl
EzvHz/dAf6eUXMN+pcwnJZpuPEkXFdu0oMWvTeu7vI1Dx7uS9ydQjTZvb5UW/vKe
fwIDAQAB
-----END PUBLIC KEY-----
CA生成自签署证书
//生成自签署证书
[root@www CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:yuqinghao
Organizational Unit Name (eg, section) []:xuexi
Common Name (eg, your name or your server's hostname) []:taikong.example.com
Email Address []:1@2.com
//读出cacert.pem证书的内容
[root@www CA]# openssl x509 -text -in cacert.pem
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
59:86:ea:fc:15:3a:a5:05:9c:7f:01:0d:82:6e:ec:b8:6e:47:b8:6e
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = cn, ST = HB, L = WH, O = runtime, OU = peixun, CN = taikong.example.com, emailAddress = 1@2.com
Validity
Not Before: Dec 21 14:49:18 2020 GMT
Not After : Dec 21 14:49:18 2021 GMT
Subject: C = cn, ST = HB, L = WH, O = runtime, OU = peixun, CN = taikong.example.com, emailAddress = 1@2.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
00:d6:f9:39:7e:8a:87:0d:e3:1c:3d:35:c9:1c:57:
92:66:32:02:42:c6:ff:01:ff:12:24:7e:b7:e7:59:
2e:1b:99:0b:e4:0c:63:ab:55:ec:51:bb:8c:dc:56:
72:23:02:7b:1e:95:75:09:00:65:7e:12:49:d6:4b:
ba:12:47:d4:d7:04:6a:fb:d1:be:64:4d:37:b0:e3:
41:22:95:ea:52:cb:93:9c:cc:34:08:30:59:59:71:
c5:97:0c:e2:da:22:37:3e:92:15:64:b3:4d:92:4e:
03:88:73:77:8c:95:66:ca:98:dc:96:60:34:af:6e:
52:49:77:42:97:23:fa:f3:fe:b7:39:a7:88:82:0d:
06:66:9b:6c:ba:52:9d:4f:36:b1:3f:10:f0:07:21:
38:98:68:d7:e3:8f:7b:68:5c:d8:14:a1:18:28:32:
e4:50:08:4a:e0:b2:5c:52:80:ae:2e:6b:b7:56:3f:
b7:86:71:e5:fd:8b:ce:2c:a8:26:f4:3f:88:dd:43:
b9:01:34:1a:22:b5:44:6d:25:94:ca:80:e5:13:3b:
c7:cf:f7:40:7f:a7:94:5c:c3:7e:a5:cc:27:25:9a:
6e:3c:49:17:15:db:b4:a0:c5:af:4d:eb:bb:bc:8d:
43:c7:bb:92:f7:27:50:8d:36:6f:6f:95:16:fe:f2:
9e:7f
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
4F:05:D3:F8:A8:3A:D0:A3:86:BF:9B:E8:D6:AA:2B:02:7E:7C:CE:16
X509v3 Authority Key Identifier:
keyid:4F:05:D3:F8:A8:3A:D0:A3:86:BF:9B:E8:D6:AA:2B:02:7E:7C:CE:16
X509v3 Basic Constraints: critical
CA:TRUE
Signature Algorithm: sha256WithRSAEncryption
83:94:d7:ee:a6:a1:a5:1e:8a:5a:ab:ad:62:31:88:dd:c3:9f:
3a:59:92:99:d3:b7:f8:ba:91:ea:7d:62:e1:7b:53:de:28:2b:
53:77:0d:fe:68:26:62:53:77:fe:2a:6e:42:de:a7:ef:d1:99:
e0:89:a6:f6:4d:73:11:d9:f1:e0:3a:9a:e6:a2:af:14:70:f2:
98:bc:ab:7c:77:11:0a:1d:5a:5a:ab:cc:9b:0a:51:9f:8f:8c:
dd:20:0a:86:85:31:d4:6f:74:ed:c5:f7:d6:7f:1d:5e:ec:01:
c1:e9:e9:bd:d2:e6:da:42:3c:c7:df:14:6a:41:c1:73:dc:93:
79:cb:95:bf:48:76:58:20:f9:99:5f:58:4a:41:3e:b6:58:08:
b1:68:b2:44:78:0c:da:1b:9f:a2:61:78:5b:14:0d:73:90:0c:
56:ce:2b:90:97:11:1c:e9:b9:7d:4c:57:8e:dc:ba:bd:8d:91:
3b:b3:0c:1c:6c:38:e3:6d:3d:8f:c3:9d:40:a8:67:f1:d4:98:
a4:c1:1e:94:ea:38:34:ce:2f:15:99:ee:e0:e5:45:97:6a:43:
ca:6c:27:f8:13:e6:c4:a7:59:d8:ce:2e:90:4b:df:5b:6a:5d:
de:9f:3c:3f:42:08:69:84:b9:43:1e:ef:d5:80:f4:14:9d:29:
14:2e:a7:30
-----BEGIN CERTIFICATE-----
MIID4zCCAsugAwIBAgIUWYbq/BU6pQWcfwENgm7suG5HuG4wDQYJKoZIhvcNAQEL
BQAwgYAxCzAJBgNVBAYTAmNuMQswCQYDVQQIDAJIQjELMAkGA1UEBwwCV0gxEDAO
BgNVBAoMB3J1bnRpbWUxDzANBgNVBAsMBnBlaXh1bjEcMBoGA1UEAwwTdGFpa29u
Zy5leGFtcGxlLmNvbTEWMBQGCSqGSIb3DQEJARYHMUAyLmNvbTAeFw0yMDEyMjEx
NDQ5MThaFw0yMTEyMjExNDQ5MThaMIGAMQswCQYDVQQGEwJjbjELMAkGA1UECAwC
SEIxCzAJBgNVBAcMAldIMRAwDgYDVQQKDAdydW50aW1lMQ8wDQYDVQQLDAZwZWl4
dW4xHDAaBgNVBAMME3RhaWtvbmcuZXhhbXBsZS5jb20xFjAUBgkqhkiG9w0BCQEW
BzFAMi5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDW+Tl+iocN
4xw9NckcV5JmMgJCxv8B/xIkfrfnWS4bmQvkDGOrVexRu4zcVnIjAnselXUJAGV+
EknWS7oSR9TXBGr70b5kTTew40EilepSy5OczDQIMFlZccWXDOLaIjc+khVks02S
TgOIc3eMlWbKmNyWYDSvblJJd0KXI/rz/rc5p4iCDQZmm2y6Up1PNrE/EPAHITiY
aNfjj3toXNgUoRgoMuRQCErgslxSgK4ua7dWP7eGceX9i84sqCb0P4jdQ7kBNBoi
tURtJZTKgOUTO8fP90B/p5Rcw36lzCclmm48SRcV27Sgxa9N67u8jUPHu5L3J1CN
Nm9vlRb+8p5/AgMBAAGjUzBRMB0GA1UdDgQWBBRPBdP4qDrQo4a/m+jWqisCfnzO
FjAfBgNVHSMEGDAWgBRPBdP4qDrQo4a/m+jWqisCfnzOFjAPBgNVHRMBAf8EBTAD
AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCDlNfupqGlHopaq61iMYjdw586WZKZ07f4
upHqfWLhe1PeKCtTdw3+aCZiU3f+Km5C3qfv0Zngiab2TXMR2fHgOprmoq8UcPKY
vKt8dxEKHVpaq8ybClGfj4zdIAqGhTHUb3TtxffWfx1e7AHB6em90ubaQjzH3xRq
QcFz3JN5y5W/SHZYIPmZX1hKQT62WAixaLJEeAzaG5+iYXhbFA1zkAxWziuQlxEc
6bl9TFeO3Lq9jZE7swwcbDjjbT2Pw51AqGfx1JikwR6U6jg0zi8Vme7g5UWXakPK
bCf4E+bEp1nYzi6QS99bal3enzw/QghphLlDHu/VgPQUnSkULqcw
-----END CERTIFICATE-----
[root@www CA]# mkdir certs newcerts crl
[root@www CA]# touch index.txt && echo 01 > serial
[root@www CA]# ls
cacert.pem certs crl index.txt newcerts private serial
客户端（例如httpd服务器）生成密钥
[root@www CA]# cd /etc/httpd && mkdir ssl && cd ssl
[root@www ssl]# (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
..+++++
..........................+++++
e is 65537 (0x010001)
客户端生成证书签署请求
[root@www ssl]# openssl req -new -key httpd.key -days 365 -out httpd.csr
Ignoring -days; not generating a certificate
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:yuqinghao
Organizational Unit Name (eg, section) []:xuexi
Common Name (eg, your name or your server's hostname) []:taikong.example.com
Email Address []:1@2.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
CA签署客户端提交上来的证书
[root@www ssl]# openssl ca -in ./httpd.csr -out httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Dec 21 15:15:55 2020 GMT
Not After : Dec 21 15:15:55 2021 GMT
Subject:
countryName = cn
stateOrProvinceName = HB
organizationName = yuqinghao
organizationalUnitName = xuexi
commonName = taikong.example.com
emailAddress = 1@2.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
F2:02:61:22:44:F9:AC:3E:61:2D:27:CF:2A:AE:E5:37:95:2B:FD:6A
X509v3 Authority Key Identifier:
keyid:4F:05:D3:F8:A8:3A:D0:A3:86:BF:9B:E8:D6:AA:2B:02:7E:7C:CE:16
Certificate is to be certified until Dec 21 15:15:55 2021 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
修改配置文件
[root@www ~]# yum -y install mod_ssl
[root@www ~]# vim /etc/httpd/conf.d/ssl.conf
<VirtualHost _default_:443>
# General setup for the virtual host, inherited from global
//取消注释修改为taikong
configurationDocumentRoot "/var/www/html/taikong/"
ServerName taikong.example.com:443
# Point SSLCertificateFile at a PEM encoded certificate. If
# the certificate is encrypted, then you will be prompted for a
# pass phrase. Note that restarting httpd will prompt again. Keep
# in mind that if you have both an RSA and a DSA certificate you
# can configure both in parallel (to also allow the use of DSA
# ciphers, etc.)
# Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
# require an ECC certificate which can also be configured in
# parallel.
//修改为刚刚生成证书的位置
SSLCertificateFile /etc/httpd/ssl/httpd.crt
# Server Private Key:
# If the key is not combined with the certificate, use this
# directive to point at the key file. Keep in mind that if
# you've both a RSA and a DSA private key you can configure
# both in parallel (to also allow the use of DSA ciphers, etc.)
# ECC keys, when in use, can also be configured in parallel
//修改为刚刚生成私钥的位置
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key
[root@www ~]# systemctl restart httpd
[root@www ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:22 [::]:*
LISTEN 0 128 *:443 *:*
LISTEN 0 128 *:80 *:*
访问https://taikong.example.com
高级-接受风险并继续
访问https://win10.example.com
以下是一步一步安装httpd时可能会遇到的错误及解决的方式
//下载源码包
[root@localhost ~]# wget https://mirrors.tuna.tsinghua.edu.cn/apache/httpd/httpd-2.4.46.tar.bz2
[root@localhost ~]# ls
anaconda-ks.cfg httpd-2.4.46.tar.bz2
//解压并进入
[root@localhost ~]# tar xf httpd-2.4.46.tar.bz2
[root@localhost ~]# ls
anaconda-ks.cfg httpd-2.4.46 httpd-2.4.46.tar.bz2
[root@localhost ~]# cd httpd-2.4.46
[root@localhost httpd-2.4.46]# ls
ABOUT_APACHE BuildBin.dsp emacs-style LAYOUT NOTICE srclib
acinclude.m4 buildconf httpd.dep libhttpd.dep NWGNUmakefile support
Apache-apr2.dsw CHANGES httpd.dsp libhttpd.dsp os test
Apache.dsw CMakeLists.txt httpd.mak libhttpd.mak README VERSIONING
apache_probes.d config.layout httpd.spec LICENSE README.cmake
ap.d configure include Makefile.in README.platforms
build configure.in INSTALL Makefile.win ROADMAP
BuildAll.dsp docs InstallBin.dsp modules server
//尝试安装httpd
[root@localhost httpd-2.4.46]# ./configure --prefix=/usr/local/httpd
checking for APR... no
configure: error: APR not found. Please read the documentation.
//解决apr not found问题
//（需要安装apr）
[root@localhost httpd-2.4.46]# cd
[root@localhost ~]# wget https://mirrors.tuna.tsinghua.edu.cn/apache//apr/apr-1.7.0.tar.gz
[root@localhost ~]# tar xf apr-1.7.0.tar.gz
[root@localhost ~]# cd apr-1.7.0
[root@localhost apr-1.7.0]# ls
apr-config.in build.conf dso libapr.rc NOTICE support
apr.dep buildconf emacs-mode LICENSE NWGNUmakefile tables
apr.dsp build-outputs.mk encoding locks passwd test
apr.dsw CHANGES file_io Makefile.in poll threadproc
apr.mak CMakeLists.txt helpers Makefile.win random time
apr.pc.in config.layout include memory README tools
apr.spec configure libapr.dep misc README.cmake user
atomic configure.in libapr.dsp mmap shmem
build docs libapr.mak network_io strings
[root@localhost apr-1.7.0]# ./configure --prefix=/usr/local/apr
[root@localhost apr-1.7.0]# echo $?
0
[root@localhost apr-1.7.0]# make
[root@localhost apr-1.7.0]# echo $?
0
[root@localhost apr-1.7.0]# make install
[root@localhost apr-1.7.0]# echo $?
0
//再尝试安装apache
[root@localhost apr-1.7.0]# cd
[root@localhost ~]# cd httpd-2.4.46
[root@localhost httpd-2.4.46]# ./configure --prefix=/usr/local/httpd
checking for APR-util... no
configure: error: APR-util not found. Please read the documentation.
//解决APR-util not found问题
//(需要安装apr-util)
[root@localhost httpd-2.4.46]# cd
[root@localhost apr-util-1.6.1]# wget https://mirrors.tuna.tsinghua.edu.cn/apache//apr/apr-util-1.6.1.tar.gz
[root@localhost ~]# tar xf apr-util-1.6.1.tar.gz
[root@localhost ~]# cd apr-util-1.6.1
[root@localhost apr-util-1.6.1]# ./configure --prefix=/usr/local/apr-util
configure: error: APR could not be located. Please use the --with-apr option.
//解决APR could not be located问题
//(安装apr-util时需要使用--with-apr=PATH)
[root@localhost apr-util-1.6.1]# ./configure --prefix=/usr/local/apr-util --with-apr=/usr/local/apr
[root@localhost apr-util-1.6.1]# make
xml/apr_xml.c:35:10: fatal error: expat.h: No such file or directory
//解决缺少expat库问题
//(需要安装expat-devel)
[root@localhost apr-util-1.6.1]# yum -y install expat-devel
[root@localhost apr-util-1.6.1]# echo $?
[root@localhost apr-util-1.6.1]# 0
[root@localhost apr-util-1.6.1]# make install
[root@localhost apr-util-1.6.1]# echo $?
[root@localhost apr-util-1.6.1]# 0
//再尝试安装httpd
[root@localhost apr-util-1.6.1]# cd
[root@localhost ~]# cd httpd-2.4.46
[root@localhost httpd-2.4.46]# ./configure --prefix=/usr/local/httpd
checking for APR-util... no
configure: error: APR-util not found. Please read the documentation.
//解决APR-util还是not found问题
//（安装httpd时需要使用--with-apr=PATH --with-apr-util=PATH）
[root@localhost httpd-2.4.46]# ./configure --prefix=/usr/local/httpd --with-apr=/usr/local/apr --with-apr-util=/usr/local/apr-util
configure: error: pcre-config for libpcre not found. PCRE is required and available from http://pcre.org/
//解决pcre not found问题
//(需要安装pcre-devel)
[root@localhost httpd-2.4.46]# yum -y install pcre-devel
//再尝试安装httpd
[root@localhost httpd-2.4.46]# ./configure --prefix=/usr/local/httpd --with-apr=/usr/local/apr --with-apr-util=/usr/local/apr-util
configure: summary of build options:
Server Version: 2.4.46
Install prefix: /usr/local/httpd
C compiler: gcc
CFLAGS: -g -O2 -pthread
CPPFLAGS: -DLINUX -D_REENTRANT -D_GNU_SOURCE
LDFLAGS:
LIBS:
C preprocessor: gcc -E
[root@localhost httpd-2.4.46]# echo $?
0
[root@localhost httpd-2.4.46]# make
collect2: error: ld returned 1 exit status
make[2]: *** [Makefile:48: htpasswd] Error 1
make[2]: Leaving directory '/root/httpd-2.4.46/support'
make[1]: *** [/root/httpd-2.4.46/build/rules.mk:75: all-recursive] Error 1
make[1]: Leaving directory '/root/httpd-2.4.46/support'
make: *** [/root/httpd-2.4.46/build/rules.mk:75: all-recursive] Error 1
[root@localhost httpd-2.4.46]# echo $?
2
//缺少了xml相关的库，需要安装libxml2-devel包。直接安装并不能解决问题，因为httpd调用的apr-util已经安装好了，但是apr-util并没有libxml2-devel包支持。
//（需要安装libxml2-devel）
[root@localhost httpd-2.4.46]# yum -y install libxml2-devel
//删除apr-util安装目录，并重新编译安装
[root@localhost httpd-2.4.46]# rm -rf /usr/local/apr-util/
[root@localhost httpd-2.4.46]# cd
[root@localhost ~]# cd apr-util-1.6.1
//清除之前配置时的缓存
[root@localhost apr-util-1.6.1]# make clean
//重新安装apr-util
[root@localhost apr-util-1.6.1]# ./configure --prefix=/usr/local/apr-util --with-apr=/usr/local/apr
[root@localhost apr-util-1.6.1]# echo $?
0
[root@localhost apr-util-1.6.1]# make
[root@localhost apr-util-1.6.1]# echo $?
0
[root@localhost apr-util-1.6.1]# make install
[root@localhost apr-util-1.6.1]# echo $?
0
//重新编译安装httpd
[root@localhost apr-util-1.6.1]# cd
[root@localhost ~]# cd httpd-2.4.46
[root@localhost httpd-2.4.46]# make clean
[root@localhost httpd-2.4.46]# ./configure --prefix=/usr/local/httpd --with-apr=/usr/local/apr --with-apr-util=/usr/local/apr-util
configure: summary of build options:
Server Version: 2.4.46
Install prefix: /usr/local/httpd
C compiler: gcc
CFLAGS: -g -O2 -pthread
CPPFLAGS: -DLINUX -D_REENTRANT -D_GNU_SOURCE
LDFLAGS:
LIBS:
C preprocessor: gcc -E
[root@localhost httpd-2.4.46]# echo $?
0
[root@localhost httpd-2.4.46]# make
[root@localhost httpd-2.4.46]# echo $?
0
[root@localhost httpd-2.4.46]# make install
[root@localhost httpd-2.4.46]# echo $?
0
//关闭防火墙修改配置文件并重启服务
[root@localhost httpd-2.4.46]# systemctl stop firewalld
[root@localhost httpd-2.4.46]# setenforce 0
[root@localhost httpd-2.4.46]# getenforce
Permissive
[root@localhost httpd-2.4.46]# /usr/local/httpd/bin/apachectl start
[root@localhost httpd-2.4.46]# vi /usr/local/httpd/conf/httpd.conf
ServerName localhost:80
[root@localhost httpd-2.4.46]# /usr/local/httpd/bin/apachectl restart
//设置环境变量
[root@localhost httpd-2.4.46]# cd
[root@localhost ~]# vi /etc/profile.d/apache.sh
export PATH=$PATH:/usr/local/httpd/bin/
[root@localhost ~]# source /etc/profile.d/apache.sh
//设置头文件链接
[root@localhost ~]# ln -s /usr/local/httpd/include/ /usr/include/httpd
//设置帮助文档（加入以下内容）
[root@localhost man]# vi /etc/man_db.conf
MANDATORY_MANPATH /usr/local/httpd/man
MANDATORY_MANPATH /usr/local/httpd/manual
//测试httpd服务
[root@localhost man]# cd
[root@localhost ~]# apachectl stop
[root@localhost ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:22 [::]:*
[root@localhost ~]# apachectl start
[root@localhost ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 *:80 *:*
LISTEN 0 128 [::]:22 [::]:*
[root@localhost ~]# ip a
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:f9:ec:35 brd ff:ff:ff:ff:ff:ff
inet 192.168.237.128/24 brd 192.168.237.255 scope global dynamic noprefixroute ens160
valid_lft 1649sec preferred_lft 1649sec
inet6 fe80::96da:6b44:5ce1:8588/64 scope link noprefixroute
valid_lft forever preferred_lft forever
测试成功
